oh-my-codex@0.21.15
Multi-agent orchestration layer for OpenAI Codex CLI
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe postinstall hook does not install agent configuration; it hydrates the native runtime for global installs and reports that setup is explicit opt-in. The explicit setup command does write first-party agent configuration, so this is a warning-level capability rather than a verified install-time attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the `omx setup` command.
Impact
The command can add or refresh agent configuration; inspected source does not show that package installation triggers this setup.
Mechanism
Setup refreshes native agent configuration in the selected agent directory.
AI rationale
The postinstall hook does not install agent configuration; it hydrates the native runtime for global installs and reports that setup is explicit opt-in. The explicit setup command does write first-party agent configuration, so this is a warning-level capability rather than a verified install-time attack.
Evidence
dist/cli/setup.jsdist/cli/index.js
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes setup as a CLI command; its setup implementation refreshes native agent configurations.
- Setup’s native-agent refresh writes into the selected agent directory.
- The inspected agent-related test locations cover configuration generation, storage, and setup behavior; they show no install-hook activation.
Evidence against
- The postinstall hook is limited to global installs; it hydrates the native runtime and records the installed version, then describes setup as explicit opt-in.
- The CLI dispatches setup only when the setup command is selected.
- The setup implementation skips native-agent refresh during background update-check setup refresh.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const fs=require('fs');const p='./dist/scripts/postinstall.js';if(fs.existsSync(p))import(p).then(m=>m.main?.()).catch(e=>console.warn('[omx] Postinstall skipped after a n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli/__tests__/detached-leader-teardown.test.jsView file
340patternName = github_fine_grained
severity = critical
line = 340
Findings
4 Critical6 High6 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/cli/__tests__/detached-leader-teardown.test.js
CriticalPrevious Version Dangerous Deltadist/scripts/smoke-packed-install.js
CriticalSecret Patterndist/cli/__tests__/detached-leader-teardown.test.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/autoresearch/runtime.js
HighShelldist/autoresearch/runtime.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/cli/setup.js
HighRuntime Package Installdist/evals/astra-defaults/collector.js
HighSemantic Analysis Limiteddist/cli/api.js#virtual:normalized:round1
Affected versions and remediation
This report applies to oh-my-codex@0.21.15.
See all versions of oh-my-codex for other recorded verdicts.
- Review the evidence and your use of oh-my-codex@0.21.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.